Privacy policy (draft)

Koby is provided by Omnibus R&D, LLC, YTU Teknopark, Çifte Havuzlar Mahallesi Eski Londra Asfaltı Caddesi Kuluçka Merkezi A2 Blok No:151/1B/Z06, İstanbul / Türkiye, Türkiye (“we”). We are the controller of the personal data described here. EU representative (GDPR Art. 27): [to be confirmed]. Contact: privacy [at] withkoby.com.

The Koby apps for parents and children, the parent web panel at app.withkoby.com and this website. Koby is a parental control service: parents create and manage children's profiles; children use Koby on their own device after a parent pairs it.

• Parent account: name, email, sign-in method, language

  Purpose

  Provide the account

  Legal basis (GDPR)

  Contract

  Retention

  Until account deletion

• Child profile: first name or nickname, age

  Purpose

  Apply age-appropriate rules

  Legal basis (GDPR)

  Parental consent; contract with the parent

  Retention

  Until profile deletion

• Device data: name, platform, OS version, notification token

  Purpose

  Pairing, rule delivery, notifications

  Legal basis (GDPR)

  Contract; consent for the child's data

  Retention

  Until the device is removed

• Rules and change history

  Purpose

  Apply rules, show the version on each device

  Legal basis (GDPR)

  Contract

  Retention

  Rules until deleted; history 90 days [to be confirmed]

• Extra-time requests and decisions

  Purpose

  Let children ask and parents answer

  Legal basis (GDPR)

  Contract; consent

  Retention

  7 days [to be confirmed]

• Protection status and setup test results

  Purpose

  Show whether controls work

  Legal basis (GDPR)

  Contract; legitimate interest in a reliable service

  Retention

  30 days [to be confirmed]

• Daily screen time totals by app or category, where the OS shares them

  Purpose

  Show time used and time left

  Legal basis (GDPR)

  Contract; consent

  Retention

  30 days [to be confirmed]

• Last known location (coordinates, accuracy, time), only if enabled

  Purpose

  Show where the device last reported from

  Legal basis (GDPR)

  Consent

  Retention

  Latest value only; deleted after 7 days

• Subscription status (from the App Store)

  Purpose

  Provide the plan you chose

  Legal basis (GDPR)

  Contract; legal obligation

  Retention

  As required by tax law

• Support and contact messages

  Purpose

  Answer you

  Legal basis (GDPR)

  Legitimate interest

  Retention

  Up to 24 months

• We do not read messages, chats or emails, or what a child types.
• We do not access the camera, microphone, photos or contacts, and we do not record the screen.
• We do not keep browsing history or a location history.
• We do not use advertising SDKs or advertising identifiers, and we do not sell or share personal data for advertising.
• We do not profile children, assign risk scores or make automated decisions with legal effect.
• We do not use children's data to train AI models.

Children's profiles are created by a parent. Before a child's device is connected, the parent gives consent for the processing described here (COPPA in the United States for children under 13; GDPR Article 8 in the EU for children under the national age of digital consent). Parents can review, export and delete their child's data at any time and withdraw consent by removing the device or deleting the profile.

Children always see that Koby is active and which adults can see which data. A version of this explanation for children is on our page for kids.

Only with service providers who process data on our behalf under contract (hosting, email delivery, push notifications, the app stores for billing), and with authorities where the law requires it. The list of processors and their locations will be published before launch [to be confirmed]. Where data leaves the EEA, we use safeguards such as the European Commission's standard contractual clauses.

Data is encrypted in transit. Each parent has their own sign-in; sessions can be ended and access removed. Access checks run on the server for every request. Report vulnerabilities to security [at] withkoby.com.

Depending on where you live, you can access, correct, export or delete your data, object to or restrict processing, and withdraw consent. You can also complain to your data protection authority. We answer within 30 days and do not charge for requests. Write to privacy [at] withkoby.com or use the contact form.

Deleting a device, a child profile or your account removes the related data from our live systems. Encrypted backups are overwritten within [period to be confirmed].

We will tell you about material changes in the app and by email before they take effect. The date at the top shows the latest version.